Summary

Change CE config, resolve the installed bundle successfully, then fail its image pull: the config can remain unapplied while CE reports Succeeded for the new generation. Part of #3042; this also occurs without resolution failure.

Current

An unchanged-bundle pull failure supplies nil content. Boxcutter leaves the COD unchanged, then maps its previous completion to CE Progressing=True/Succeeded with the current CE generation.

Expected

Acknowledge new configuration only after it is projected into the COD. If content is unavailable, report the unapplied request without losing existing workload health.

Evidence

• Pull failure becomes nil content
• Nil-content apply only checks COD existence
• Prior COD completion becomes current-generation CE success